| 1 | --- |
| 2 | title: Start here |
| 3 | description: A guided checklist to get logs flowing, dashboards populated, and alerts/cases working in SOCFortress CoPilot. |
| 4 | --- |
| 5 | |
| 6 | This is the **primary onboarding checklist** for CoPilot. |
| 7 | |
| 8 | CoPilot sits on top of an open-source SIEM stack. To get value fast, you want this order: |
| 9 | |
| 10 | 1) **Ingest** (endpoints + integrations + syslog) |
| 11 | 2) **Visualize** (dashboards) |
| 12 | 3) **Detect** (alerts) |
| 13 | 4) **Respond** (alerts → cases → IR) |
| 14 | |
| 15 | If you’re unsure what role you are, read [Roles & mental model](/getting-started/roles-and-mental-model) first. |
| 16 | |
| 17 | --- |
| 18 | |
| 19 | ## Success definition (what “done” looks like) |
| 20 | |
| 21 | You’re “onboarded” when: |
| 22 | |
| 23 | - [ ] You can confirm **endpoint logs** are arriving (Wazuh) |
| 24 | - [ ] You can confirm **integration/syslog logs** are arriving (External Services / Network Connectors) |
| 25 | - [ ] You can open a **Grafana dashboard** that is populated with real data |
| 26 | - [ ] A **Graylog alert** appears in CoPilot (**Incident Management → Alerts**) |
| 27 | - [ ] An operator can open a **case** from an alert and track investigation work |
| 28 | |
| 29 | --- |
| 30 | |
| 31 | ## 0) Prereqs (10 minutes) |
| 32 | |
| 33 | Do these before troubleshooting anything else. |
| 34 | |
| 35 | - [ ] In CoPilot, configure and verify **Connectors** (Wazuh, Graylog, Grafana, Velociraptor). |
| 36 | - If a connector can’t verify, stop here and fix connectivity/credentials. |
| 37 | - [ ] Decide your **customer code** convention (short, stable, no spaces). |
| 38 | - You’ll use this for routing/indexing/provisioning. |
| 39 | |
| 40 | Helpful pages: |
| 41 | - [Admin/Engineer quickstart](/user/admins-quickstart) |
| 42 | - [Customer provisioning (tenancy)](/user/customer-provisioning) |
| 43 | - [UI navigation guide](/user/navigation) |
| 44 | |
| 45 | --- |
| 46 | |
| 47 | ## 1) Ingest logs (make data exist) |
| 48 | |
| 49 | ### 1A) Endpoints — Wazuh (usually first) |
| 50 | |
| 51 | **Goal:** endpoints are enrolled and reporting; CoPilot shows them as healthy. |
| 52 | |
| 53 | Checklist: |
| 54 | - [ ] Enroll at least 1 endpoint (Windows or Linux) into Wazuh. |
| 55 | - [ ] Confirm the endpoint appears in CoPilot under **Agents** and shows online/healthy. |
| 56 | - [ ] Confirm the agent is associated with the correct tenant/customer context. |
| 57 | |
| 58 | Success criteria: |
| 59 | - You can point to **one real endpoint** in CoPilot and say “this host is actively producing telemetry.” |
| 60 | |
| 61 | Next (UI reference): |
| 62 | - [Agents](/user/ui/agents) |
| 63 | - [Agent groups](/user/ui/agents-groups) |
| 64 | |
| 65 | ### 1B) Third‑party integrations — API sources |
| 66 | |
| 67 | Examples: Office 365, Mimecast, Huntress, CrowdStrike. |
| 68 | |
| 69 | **Goal:** events are arriving under the correct customer scope. |
| 70 | |
| 71 | Checklist: |
| 72 | - [ ] Configure at least 1 integration under **External Services**. |
| 73 | - [ ] Confirm events are flowing (don’t worry about dashboards yet). |
| 74 | |
| 75 | Success criteria: |
| 76 | - You can find at least **one recent event** for the integration and tie it to a customer. |
| 77 | |
| 78 | Next (UI reference): |
| 79 | - [External services](/user/ui/external-services) |
| 80 | - [3rd party integrations](/user/ui/external-third-party-integrations) |
| 81 | |
| 82 | ### 1C) Network connectors — syslog |
| 83 | |
| 84 | **Goal:** syslog events arrive from at least one device/source. |
| 85 | |
| 86 | Checklist: |
| 87 | - [ ] Configure a network connector. |
| 88 | - [ ] Confirm syslog events are arriving and are tenant-aware (routed/tagged correctly). |
| 89 | |
| 90 | Success criteria: |
| 91 | - You can identify the source device + see fresh events in the expected location. |
| 92 | |
| 93 | Next (UI reference): |
| 94 | - [Network connectors](/user/ui/external-network-connectors) |
| 95 | |
| 96 | --- |
| 97 | |
| 98 | ## 2) Visualize (make data understandable) |
| 99 | |
| 100 | CoPilot uses **Grafana** for dashboards. During **customer provisioning**, CoPilot can deploy **templated dashboards** so you get immediate visibility. |
| 101 | |
| 102 | Checklist: |
| 103 | - [ ] Verify the **Grafana connector**. |
| 104 | - [ ] Run **customer provisioning** for a test customer. |
| 105 | - [ ] Confirm dashboards are deployed into the customer’s Grafana org. |
| 106 | - [ ] Open at least 1 dashboard and confirm it’s populated (not empty panels). |
| 107 | |
| 108 | Success criteria: |
| 109 | - You can show a dashboard with **real, current** data for a specific customer. |
| 110 | |
| 111 | Next: |
| 112 | - [Customer provisioning](/user/customer-provisioning) |
| 113 | - Videos (browse by role): [Videos](/user/videos) |
| 114 | |
| 115 | --- |
| 116 | |
| 117 | ## 3) Detect (make data actionable) |
| 118 | |
| 119 | CoPilot uses **Graylog** for searching and alerting. |
| 120 | |
| 121 | Mental model: |
| 122 | - ingestion → streams/pipelines → event definitions → alerts written to `gl-events*` |
| 123 | - CoPilot reads those into **Incident Management → Alerts** |
| 124 | |
| 125 | Checklist: |
| 126 | - [ ] Verify the **Graylog connector**. |
| 127 | - [ ] Ensure alert plumbing exists (built-in definitions or create one custom). |
| 128 | - [ ] Trigger a test event and confirm an alert is created. |
| 129 | - [ ] Confirm the alert is visible in CoPilot under **Incident Management → Alerts**. |
| 130 | |
| 131 | Success criteria: |
| 132 | - A new alert appears in CoPilot and you can explain “what fired” + “what data it was based on.” |
| 133 | |
| 134 | Next (UI reference): |
| 135 | - [Graylog management](/user/ui/graylog-management) |
| 136 | - [Incident alerts](/user/ui/incident-alerts) |
| 137 | |
| 138 | --- |
| 139 | |
| 140 | ## 4) Respond (alerts → cases) |
| 141 | |
| 142 | Checklist: |
| 143 | - [ ] Open an alert. |
| 144 | - [ ] Create a case from it. |
| 145 | - [ ] Add at least one note/comment/evidence link. |
| 146 | - [ ] Assign/track status so it’s obvious what’s being worked. |
| 147 | |
| 148 | Success criteria: |
| 149 | - An operator can manage an investigation end-to-end without leaving CoPilot. |
| 150 | |
| 151 | Next (UI reference): |
| 152 | - [Incident cases](/user/ui/incident-cases) |
| 153 | |
| 154 | --- |
| 155 | |
| 156 | ## 5) Endpoint IR (Velociraptor) |
| 157 | |
| 158 | Velociraptor provides response capabilities: remote commands, artifact collection, and evidence gathering. |
| 159 | |
| 160 | Checklist: |
| 161 | - [ ] Verify the **Velociraptor connector**. |
| 162 | - [ ] Run one basic artifact collection against a test endpoint. |
| 163 | - [ ] Confirm you can retrieve/view results in CoPilot. |
| 164 | |
| 165 | Success criteria: |
| 166 | - You can collect at least one artifact and attach/associate results to investigation work. |
| 167 | |
| 168 | Next: |
| 169 | - Velociraptor-focused walkthroughs in [Videos](/user/videos) |
| 170 | |
| 171 | --- |
| 172 | |
| 173 | ## 6) Expand (power features) |
| 174 | |
| 175 | Once the core SIEM loop is working, layer in these modules: |
| 176 | |
| 177 | - Vulnerability + SCA views (Wazuh-backed) |
| 178 | - Microsoft Patch Tuesday prioritization |
| 179 | - Cloud security assessment outputs (Scout Suite) |
| 180 | - Web vulnerability assessment (Nuclei) |
| 181 | - GitHub audit |
| 182 | - AI-assisted reporting / report creation |
| 183 | |
| 184 | (We’ll link each of these to dedicated pages as we wireframe them.) |